dsh-remote-bridge 2.3.0 → 2.3.3

package/README.en.md

@@ -9,7 +9,7 @@
 </p>
 
 <p align="center">
-  <img alt="Version" src="https://img.shields.io/badge/version-v2.3.0-087f8c">
+  <img alt="Version" src="https://img.shields.io/badge/version-v2.3.3-087f8c">
   <img alt="DSH plugin" src="https://img.shields.io/badge/DeepSeek_Harness-plugin-1f2328">
   <img alt="Platforms" src="https://img.shields.io/badge/platform-Windows%20%7C%20macOS%20%7C%20Linux-586069">
   <img alt="License" src="https://img.shields.io/badge/license-AGPL--3.0-2da44e">
@@ -30,7 +30,7 @@ The interface is bilingual and defaults to Chinese. Prebuilt packages run on Win
 
 ## What it looks like
 
-The desktop entry lives **inside your DSH settings**: under **📱 Phone access** you will find **📱 Phone settings**, which renders seven collapsible cards inline — no second dialog. It is settings-only and contains **no file tree**: the standalone page `/dsh-workspace` and its file tree and CodeMirror editor were deleted in 2.2.0. The reason and the cost are covered in "No file-management UI on the desktop" below.
+The desktop entry lives **inside your DSH settings**: look for the section titled **📱 Phone settings**, which renders seven collapsible cards inline — no second dialog. It is settings-only and contains **no file tree**: the standalone page `/dsh-workspace` and its file tree and CodeMirror editor were deleted in 2.2.0. The reason and the cost are covered in "No file-management UI on the desktop" below.
 
 Remote access remains disabled until a local administrator chooses a bind address, port, and initial device permissions.
 
@@ -73,10 +73,10 @@ dsh plugin --profile web add dsh-remote-bridge
 dsh plugin --profile web add dsh-remote-bridge --registry https://registry.npmmirror.com
 
 # 2. tarball from the GitHub release
-dsh plugin --profile web add https://github.com/westanke/dsh-remote-bridge/releases/download/v2.3.0/dsh-remote-bridge-v2.3.0.tgz
+dsh plugin --profile web add https://github.com/westanke/dsh-remote-bridge/releases/download/v2.3.3/dsh-remote-bridge-v2.3.3.tgz
 
 # 3. tarball from the Gitee release (faster from mainland China)
-dsh plugin --profile web add https://gitee.com/westanke/dsh-remote-bridge/releases/download/v2.3.0/dsh-remote-bridge-v2.3.0.tgz
+dsh plugin --profile web add https://gitee.com/westanke/dsh-remote-bridge/releases/download/v2.3.3/dsh-remote-bridge-v2.3.3.tgz
 
 npx @deepseek-ai/dsh web
 ```
@@ -88,17 +88,17 @@ npx @deepseek-ai/dsh web
 > are reading on, but `/releases/download/...` has no relative form. The npm package name is the
 > same as the GitHub repository, so it reads identically on both hosts.
 
-Restart DSH after installation, then open settings — **Phone settings** sits right below **Phone access**. It is settings-only and does **not** contain the file tree. The in-conversation **Files** tab was removed in 2.0.4. **The desktop no longer offers a UI for browsing or editing files**: the standalone page `/dsh-workspace` was deleted in 2.2.0 — use the phone app, or ask the agent to use its tools in a conversation.
+Restart DSH after installation, then open settings — The section is titled **📱 Phone settings**. It is settings-only and does **not** contain the file tree. The in-conversation **Files** tab was removed in 2.0.4. **The desktop no longer offers a UI for browsing or editing files**: the standalone page `/dsh-workspace` was deleted in 2.2.0 — use the phone app, or ask the agent to use its tools in a conversation.
 
 To install a downloaded release archive:
 
 ```sh
-dsh plugin --profile web add ./dsh-remote-bridge-v2.3.0.tgz
+dsh plugin --profile web add ./dsh-remote-bridge-v2.3.3.tgz
 ```
 
 ## First connection
 
-1. Open DSH settings and go to **Phone settings** (below **Phone access**; it lands on **Roots**).
+1. Open DSH settings and go to **Phone settings** (it lands on **Roots**).
 2. Add a local directory under **Roots** and give it a recognizable label.
 3. For mobile access, go to **Remote**, enter the bind IP and port, and save them.
 4. Select **Enable and create pairing**, then enter the ten-minute one-time code in the app.
@@ -297,7 +297,7 @@ The user-visible consequence: **if this DSH build provides no attachment store,
 
 **Phone settings is missing**
 
-The entry is inside DSH settings, right below **Phone access**. If you cannot see it, make sure the plugin was installed into the `web` profile and **restart DSH** — plugins load in-process and a restart is required.
+The entry is inside DSH settings, under the title **📱 Phone settings**. If you cannot see it, make sure the plugin was installed into the `web` profile and **restart DSH** — plugins load in-process and a restart is required.
 
 **There is no UI for browsing or editing files on the desktop**
 
@@ -327,11 +327,11 @@ pnpm pack
 
 `npm pack` produces roughly a **0.25 MB** archive: 2.2.0 dropped the standalone page and its editor dependencies and turned source maps off, down from 1.72 MB.
 
-v2.3.0 was developed against DSH `master@47f943859bef60e4160492346772ded9b24f765a`. CI covers Windows, Ubuntu, and macOS.
+v2.3.3 was developed against DSH `master@47f943859bef60e4160492346772ded9b24f765a`. CI covers Windows, Ubuntu, and macOS.
 
 ## Project
 
-- Version: `v2.3.0`
+- Version: `v2.3.3`
 - Author: upstream [Hakunm](https://github.com/Hakunm); this fork maintained by [westanke](https://github.com/westanke)
 - Repository: [GitHub](https://github.com/westanke/dsh-remote-bridge) · [Gitee](https://gitee.com/westanke/dsh-remote-bridge)
 - npm: [`dsh-remote-bridge`](https://www.npmjs.com/package/dsh-remote-bridge) ([mainland-China mirror](https://registry.npmmirror.com/dsh-remote-bridge))

package/README.md

@@ -9,18 +9,17 @@
 </p>
 
 <p align="center">
-  <img alt="Version" src="https://img.shields.io/badge/version-v2.3.0-087f8c">
+  <img alt="Version" src="https://img.shields.io/badge/version-v2.3.3-087f8c">
   <img alt="DSH plugin" src="https://img.shields.io/badge/DeepSeek_Harness-plugin-1f2328">
   <img alt="Platforms" src="https://img.shields.io/badge/platform-Windows%20%7C%20macOS%20%7C%20Linux-586069">
   <img alt="License" src="https://img.shields.io/badge/license-AGPL--3.0-2da44e">
 </p>
 
-`dsh-remote-bridge` 是 DeepSeek Harness（DSH）的远程访问桥接插件：它把 DSH 内核的私有 remote 协议翻译成版本化的 REST 接口，让 dsh-companion（[GitHub](https://github.com/westanke/dsh-companion) · [Gitee](https://gitee.com/westanke/dsh-companion)）等受信任客户端在离开电脑后仍能使用同一套聊天、工作区与文件能力；桌面端在你的 DSH 设置里提供一个「手机设置」，内联七张设置卡片（根目录 / 远程访问 / 设备 / 识图 / 回收站 / 审计 / App 下载），每张卡片各自折叠、可多张同时展开。**桌面端不再提供文件管理界面**：文件树与编辑器已于 2.2.0 删除，电脑上管理文件请走手机 App，或在会话里让 agent 用工具完成（见「桌面端不再有文件管理界面」）。
+`dsh-remote-bridge` 是 DeepSeek Harness（DSH）的远程访问桥接插件：它把 DSH 内核的私有 remote 协议翻译成版本化的 REST 接口，让 dsh-companion（[GitHub](https://github.com/westanke/dsh-companion) · [Gitee](https://gitee.com/westanke/dsh-companion)）等受信任客户端在离开电脑后仍能使用同一套聊天、工作区与文件能力；桌面端在你的 DSH 设置里提供一个「手机设置」，内联七张设置卡片（根目录 / 远程访问 / 设备 / 识图 / 回收站 / 审计 / App 下载），每张卡片各自折叠、可多张同时展开。）。
 
 界面默认中文，可随时切换 English。插件支持 Windows、macOS 和 Linux，安装包已经包含编译产物，不要求用户在服务器上重新构建。
 
-> **版本警告**：已发布的 `v2.0.0` 与 `v2.0.1` 存在严重缺陷（`v2.0.0` 历史图片读取全部失败，`v2.0.1` 插件无法激活）。请务必使用 **`v2.2.0`**（或 ≥ `v2.0.4`）。
-> `v2.0.2` 与 `v2.0.3` **从未发布**，请不要按这两个版本号寻找安装包。
+> **版本警告**：请务必使用  ≥ `v2.0.4`版本。
 
 > **DSH 0.2.x 兼容性**：本分支在上游 `v1.0.0` 的基础上增加了对 DSH `0.2.0-rc.2` 的兼容层。
 > 0.2.x 用 `dsh-api-gateway` 替换了提供 `apiProxy` 服务的 `dsh-host-apiproxy`，导致上游版本在
@@ -29,11 +28,10 @@
 
 ## 实际效果
 
-桌面端的入口**就在你的 DSH 设置里**：打开设置，在「通用设置」下面就是「📱 手机设置」，点进去直接内联渲染七张折叠卡片，不再另开弹窗。它只做设置，**不含文件树**——独立页 `/dsh-workspace` 以及其中的文件树、CodeMirror 编辑器已于 2.2.0 一并删除，理由与代价见下文「桌面端不再有文件管理界面」。
+桌面端的入口**就在你的 DSH 设置里**：打开设置，找到标题为「📱 手机设置」的一节，点进去直接内联渲染七张折叠卡片，不再另开弹窗。它只做设置。
 
 远程访问默认关闭。管理员可在本机 WebUI 中设置绑定 IP、端口和新设备的初始权限。
 
-> 本节原先配有两张界面截图，但那是改名前的旧界面（标题仍是「DSH 文件工作区」；远程访问那张还标着 v1.0.0，且是文件树与设置两个弹窗叠加的形态），与上面描述的当前形态完全不符，已删除以免误导。缓存的旧截图不会自动更新，请以本节文字与 `docs/project/ARCHITECTURE.md` 为准。
 
 ## 关于改名（2.0.4）
 
@@ -72,10 +70,10 @@ dsh plugin --profile web add dsh-remote-bridge
 dsh plugin --profile web add dsh-remote-bridge --registry https://registry.npmmirror.com
 
 # ② GitHub Release 的 tarball
-dsh plugin --profile web add https://github.com/westanke/dsh-remote-bridge/releases/download/v2.3.0/dsh-remote-bridge-v2.3.0.tgz
+dsh plugin --profile web add https://github.com/westanke/dsh-remote-bridge/releases/download/v2.3.3/dsh-remote-bridge-v2.3.3.tgz
 
 # ③ Gitee Release 的 tarball（国内访问更快）
-dsh plugin --profile web add https://gitee.com/westanke/dsh-remote-bridge/releases/download/v2.3.0/dsh-remote-bridge-v2.3.0.tgz
+dsh plugin --profile web add https://gitee.com/westanke/dsh-remote-bridge/releases/download/v2.3.3/dsh-remote-bridge-v2.3.3.tgz
 
 npx @deepseek-ai/dsh web
 ```
@@ -91,7 +89,7 @@ npx @deepseek-ai/dsh web
 从 GitHub Release 下载离线安装包时，可直接安装 tarball：
 
 ```sh
-dsh plugin --profile web add ./dsh-remote-bridge-v2.3.0.tgz
+dsh plugin --profile web add ./dsh-remote-bridge-v2.3.3.tgz
 ```
 
 ## 第一次使用
@@ -142,7 +140,7 @@ dsh plugin --profile web add ./dsh-remote-bridge-v2.3.0.tgz
 - **识图路径**默认 `.dsh-images`，在设置页「识图」里可以改，改完立即生效、不需要重启；**「当前默认」那一栏是只读的** —— 历史交接消息和识图工具都按它写过路径，它不跟着你的修改走。旁边还列出解析不出会话工作目录时用的兜底目录。
 - **只认交接句式**，而且只认**你自己发的那条消息**：助手正文、上下文注入、工具输出里出现的 `.dsh-images/…` 不会被渲染成图（对话里到处都是这种引用，读它们只会把别人的话切成碎图）。
 
-> 如果你此前装过 `dsh-image-paths`，请把它那一行**停用**：两个插件的图集会挂在同一个位置，同一张图会被画两遍。本插件已自带这套能力。
+> 如果你此前装过 [dsh-image-paths](https://github.com/lunar-tear/dsh-plugins)，请把它那一行**停用**：两个插件的图集会挂在同一个位置，同一张图会被画两遍。本插件已自带这套能力。
 
 ### 连接 Android App 或其他客户端
 
@@ -291,7 +289,7 @@ DSH 的 cordis 注入属性（`ctx.attachments` / `ctx.fileUploads`）是惰性
 
 **安装后看不到「手机设置」**
 
-入口在 DSH 设置里，位于「手机访问」下面。如果看不到，确认插件安装在 `web` profile，并在安装后**重启 DSH**（插件为进程内加载，不重启不生效）。
+入口在 DSH 设置里，标题为「📱 手机设置」。如果看不到，确认插件安装在 `web` profile，并在安装后**重启 DSH**（插件为进程内加载，不重启不生效）。
 
 **桌面上找不到浏览或编辑文件的界面**
 
@@ -321,11 +319,11 @@ pnpm pack
 
 `npm pack` 的产物约 **0.25 MB**：2.2.0 删除独立页及其编辑器依赖、并关闭 source map 之后，从 1.72 MB 降下来。
 
-v2.3.0 基于 DSH `master@47f943859bef60e4160492346772ded9b24f765a` 开发，CI 覆盖 Windows、Ubuntu 和 macOS。
+v2.3.3 基于 DSH `master@47f943859bef60e4160492346772ded9b24f765a` 开发，CI 覆盖 Windows、Ubuntu 和 macOS。
 
 ## 项目信息
 
-- 当前版本：`v2.3.0`
+- 当前版本：`v2.3.3`
 - 作者：上游 [Hakunm](https://github.com/Hakunm)，本 fork 维护 [westanke](https://github.com/westanke)
 - 仓库：[GitHub](https://github.com/westanke/dsh-remote-bridge) · [Gitee](https://gitee.com/westanke/dsh-remote-bridge)
 - npm：[`dsh-remote-bridge`](https://www.npmjs.com/package/dsh-remote-bridge)（[国内镜像](https://registry.npmmirror.com/dsh-remote-bridge)）

package/docs/api/asyncapi.yaml

@@ -1,7 +1,7 @@
 asyncapi: 3.0.0
 info:
   title: DeepSeek Harness Mobile Events
-  version: 2.3.0
+  version: 2.3.3
   description: |
     Live file and authorized DSH chat events. Reconnect clients must refresh
     REST state; unbounded replay is not provided.

package/docs/api/openapi.yaml

@@ -1,7 +1,7 @@
 openapi: 3.1.0
 info:
   title: DeepSeek Harness Mobile API
-  version: 2.3.0
+  version: 2.3.3
   description: Versioned file and chat BFF for mobile and third-party DSH clients. HTTP and HTTPS are both supported.
 servers:
   - url: http://127.0.0.1:3090/api/v1
@@ -24,7 +24,7 @@ paths:
                 properties:
                   ok: { type: boolean, const: true }
                   version: { type: string, const: v1 }
-                  pluginVersion: { type: string, const: 2.3.0 }
+                  pluginVersion: { type: string, const: 2.3.3 }
   /pairings/exchange:
     post:
       security: []
@@ -334,6 +334,56 @@ paths:
               schema: { $ref: '#/components/schemas/ProviderSettings' }
         '400': { $ref: '#/components/responses/Error' }
         '409': { $ref: '#/components/responses/Error' }
+  /settings/plugins:
+    get:
+      operationId: listPlugins
+      description: Lists every package the active profile declares or loads, with its resolved state.
+      parameters:
+        - name: checkUpdates
+          in: query
+          required: false
+          schema: { type: string, enum: ['1'] }
+          description: 'When `1`, also queries the npm registry for each installed third-party package. Adds seconds to the response, so it is opt-in.'
+      responses:
+        '200':
+          description: 'Plugin inventory. `available: false` plus a `reason` means the profile could not be resolved or read; the endpoint does not fail for that.'
+          content:
+            application/json:
+              schema: { $ref: '#/components/schemas/PluginInventory' }
+    patch:
+      operationId: setPluginLoaded
+      description: |
+        Enables or disables a plugin by adding or removing its name in `dsh.profile.bundles`.
+        Dependency declarations are left alone (the package stays on disk and can be re-enabled
+        without downloading), and no package install runs. A backup of the profile manifest is
+        written before any change. **Bundles are read only at startup**, so the running DSH keeps
+        the previous set until it restarts.
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              required: [name, loaded]
+              properties:
+                name: { type: string, examples: [dsh-ffmpeg] }
+                loaded: { type: boolean, description: 'true to enable, false to disable.' }
+      responses:
+        '200':
+          description: 'Applied. The response carries `restartRequired: true`.'
+          content:
+            application/json:
+              schema: { $ref: '#/components/schemas/PluginToggleResult' }
+        '400':
+          description: 'Bad request, official package, or package not installed. Error codes: REQUEST_INVALID, PLUGIN_NAME_INVALID, PLUGIN_OFFICIAL_IMMUTABLE, PLUGIN_NOT_INSTALLED.'
+          content:
+            application/json:
+              schema: { $ref: '#/components/schemas/Error' }
+        '503':
+          description: 'The profile could not be resolved or its manifest could not be read. Error codes: PROFILE_UNKNOWN, MANIFEST_UNREADABLE.'
+          content:
+            application/json:
+              schema: { $ref: '#/components/schemas/Error' }
   /settings/models:
     get:
       operationId: listModelCatalog
@@ -837,6 +887,64 @@ components:
         application/json:
           schema: { $ref: '#/components/schemas/ErrorEnvelope' }
   schemas:
+    PluginEntry:
+      type: object
+      description: One package the active profile declares or loads. Contents are limited to these fields; the package manifest itself is never forwarded.
+      required: [name, declared, installed, loaded, official, state, description, homepage, updateAvailable, latestVersion, toggleable]
+      properties:
+        name: { type: string, examples: [dsh-ffmpeg, '@liustack/modlens'] }
+        declared:
+          type: [string, 'null']
+          description: Version range declared in `dependencies`, e.g. `^0.4.5`.
+        installed:
+          type: [string, 'null']
+          description: Version actually present in the profile's node_modules.
+        loaded:
+          type: boolean
+          description: Whether the name appears in `dsh.profile.bundles` (the load list; its order is the load order).
+        official: { type: boolean, description: 'True for `@deepseek-ai/` packages, which ship with the runtime.' }
+        state:
+          type: string
+          enum: [loaded, runtime-provided, installed-not-loaded, declared-missing]
+          description: '`runtime-provided` is normal, not a problem: those packages ship with DSH and are not installed under the profile.'
+        description: { type: [string, 'null'] }
+        homepage: { type: [string, 'null'], description: 'Normalized http(s) URL; git+ prefixes and .git suffixes are stripped.' }
+        updateAvailable:
+          type: [boolean, 'null']
+          description: 'Tri-state on purpose: null means not checked, which differs from false ("already latest").'
+        latestVersion: { type: [string, 'null'] }
+        toggleable:
+          type: boolean
+          description: 'False for official packages and for packages not installed in the profile.'
+    PluginInventory:
+      type: object
+      required: [profile, profilePath, available, reason, loadedCount, problemCount, items]
+      properties:
+        profile: { type: [string, 'null'], description: 'Resolved from DSH_PROFILE, `--profile`, or the `dsh <name>` subcommand shorthand.' }
+        profilePath: { type: [string, 'null'] }
+        available: { type: boolean }
+        reason:
+          type: [string, 'null']
+          enum: [PROFILE_UNKNOWN, MANIFEST_UNREADABLE, null]
+        loadedCount: { type: integer }
+        problemCount: { type: integer, description: 'Counts installed-not-loaded and declared-missing; runtime-provided is not counted.' }
+        items:
+          type: array
+          items: { $ref: '#/components/schemas/PluginEntry' }
+    PluginToggleResult:
+      type: object
+      description: Result of enabling or disabling a plugin. Only `dsh.profile.bundles` is rewritten; dependency declarations are never touched and no package install runs.
+      required: [name, loaded, backupName, bundleCount, restartRequired]
+      properties:
+        name: { type: string }
+        loaded: { type: boolean }
+        backupName:
+          type: string
+          description: 'Name of the backup written before the change (empty for a no-op). A broken profile manifest means DSH will not boot, so a backup is mandatory.'
+        bundleCount: { type: integer, description: 'New length of the bundles array.' }
+        restartRequired:
+          type: boolean
+          description: 'Always true: bundles are read only at startup, so the running process keeps the old set until DSH restarts.'
     WirePath:
       type: string
       description: POSIX-style relative path. Absolute paths, backslashes, empty segments, dot segments, drive letters, UNC and null bytes are rejected.

package/kotlin-sdk/build.gradle.kts

@@ -4,7 +4,7 @@ plugins {
 }
 
 group = "ai.deepseek.dsh"
-version = "2.3.0"
+version = "2.3.3"
 
 repositories { mavenCentral() }
 

package/lib/index.d.ts

@@ -512,6 +512,25 @@ interface SessionControllerLike {
   }): Promise<{
     sessionId: string;
   }>;
+  /**
+   * Read one message-aligned history page without activating an Agent.
+   *
+   * `throughSeq` must be obtained from the corresponding follow opening frame's
+   * `cursor`; hard-coding one returns a well-formed but empty page.
+   * `beforeSeq` is optional and acts as an earlier boundary.
+   */
+  page(request: {
+    address: {
+      kind: 'session';
+      sessionId: string;
+    };
+    throughSeq: number;
+    beforeSeq?: number;
+    maxMessages?: number;
+  }, signal: AbortSignal): Promise<{
+    records: readonly unknown[];
+    hasMore: boolean;
+  }>;
   /**
    * 取一张**被这个会话引用过**的图片字节（内核主机端方法，名字就叫 `attachment`）。
    *

package/lib/index.js

@@ -2475,7 +2475,7 @@ function createDsh02ApiProxy(host, options = {}) {
 			}),
 			create: (request) => call(() => host.sessionController.create(request.payload)),
 			history: (request) => call(async () => {
-				const { sessionId, maxMessages } = request.payload;
+				const { sessionId, maxMessages, beforeSeq } = request.payload;
 				const controller = new AbortController();
 				try {
 					const snapshot = (await host.sessionController.follow({
@@ -2489,10 +2489,23 @@ function createDsh02ApiProxy(host, options = {}) {
 						events: [],
 						hasMore: false
 					};
-					return {
+					if (beforeSeq === void 0) return {
 						events: Array.isArray(snapshot.records) ? [...snapshot.records] : [],
 						hasMore: snapshot.hasMore === true
 					};
+					const page = await host.sessionController.page({
+						address: {
+							kind: "session",
+							sessionId
+						},
+						throughSeq: snapshot.cursor,
+						beforeSeq,
+						...maxMessages === void 0 ? {} : { maxMessages }
+					}, controller.signal);
+					return {
+						events: Array.isArray(page.records) ? [...page.records] : [],
+						hasMore: page.hasMore === true
+					};
 				} finally {
 					controller.abort();
 				}
@@ -3228,8 +3241,18 @@ function defaultDisplayName() {
 /**
 * 解析当前 profile 名。
 *
-* 依次尝试：`DSH_PROFILE` 环境变量 → `--profile=<name>` → `--profile <name>`。
+* 依次尝试：`DSH_PROFILE` 环境变量 → `--profile=<name>` → `--profile <name>`
+* → **子命令简写**（`dsh web` 等价于 `dsh --profile web`）。
 * 都拿不到时返回 null（调用方不要猜，猜错会读到另一个 profile 的清单）。
+*
+* 最后那条简写路径是补上的一个真 bug：内核的启动器文档写得很清楚 ——
+*
+* > `dsh <name>` abbreviates `dsh --profile <name>`；`dsh web` boots the web
+* > profile (same as: `dsh --profile web`)
+*
+* 而此前这里只认 `--profile` 两种写法。于是**用 `dsh web` 启动的用户会看到
+* 「服务器判定不出当前使用的插件档案」** —— 明明 profile 就在那儿、插件也正常
+* 加载着，只有这个页面读不出来。这不是「用户没带参数」，是插件漏了一条启动形式。
 */
 function resolveProfileName(input = {}) {
 	const env = input.env ?? process.env;
@@ -3244,6 +3267,39 @@ function resolveProfileName(input = {}) {
 	if (index >= 0) {
 		const value = argv[index + 1]?.trim();
 		if (value && !value.startsWith("-")) return value;
+		return null;
+	}
+	return profileFromSubcommand(argv);
+}
+/**
+* 从子命令简写里取 profile 名（`dsh web` → `web`）。
+*
+* 判据照抄内核启动器的解析规则：**跳过所有选项，第一个非选项 token 就是子命令**。
+* 需要绕开两类 token：
+*
+* - 选项本身（以 `-` 开头）—— 例如 `dsh --port 3080 web` 里要先跳过 `--port`；
+* - **选项的取值** —— 上面那个 `3080` 不是选项也不是子命令，只是 `--port` 的值。
+*   不跳它的话会把 `3080` 当成 profile 名。内核的选项都是「一个旗标接一个值」的
+*   单值形式（`--port 3080` / `--patch a.yml`），所以看到选项就把它的下一个 token
+*   一起跳过，是安全的。
+*
+* `plugin` 单独排除：`dsh plugin add xxx` 是管理插件依赖的命令，
+* 它**不启动任何 profile**，把它当 profile 名会去读一个不存在的目录。
+*/
+function profileFromSubcommand(argv) {
+	const start = argv.findIndex((arg) => /(^|[/\\])dsh(\.js|\.cjs|\.mjs)?$/.test(arg));
+	let i = start >= 0 ? start + 1 : 0;
+	while (i < argv.length) {
+		const arg = argv[i];
+		if (arg === void 0 || arg === "") {
+			i += 1;
+			continue;
+		}
+		if (arg.startsWith("-")) {
+			i += arg.includes("=") ? 1 : 2;
+			continue;
+		}
+		return arg === "plugin" ? null : arg;
 	}
 	return null;
 }
@@ -3289,10 +3345,13 @@ async function readPluginInventory(input = {}) {
 	const names = [.../* @__PURE__ */ new Set([...Object.keys(dependencies), ...bundles])].sort();
 	const items = [];
 	for (const name of names) {
-		const installed = await readInstalledVersion(profilePath, name);
+		const pkgManifest = await readPackageManifest(profilePath, name);
+		const installedRaw = pkgManifest?.version;
+		const installed = typeof installedRaw === "string" && installedRaw.trim() ? installedRaw : null;
 		const loaded = bundles.includes(name);
 		const declared = dependencies[name] ?? null;
 		const official = name.startsWith("@deepseek-ai/");
+		const description = typeof pkgManifest?.description === "string" && pkgManifest.description.trim() ? pkgManifest.description.trim() : null;
 		items.push({
 			name,
 			declared,
@@ -3303,7 +3362,12 @@ async function readPluginInventory(input = {}) {
 				loaded,
 				installed,
 				official
-			})
+			}),
+			description,
+			homepage: readHomepage(pkgManifest),
+			updateAvailable: null,
+			latestVersion: null,
+			toggleable: !official && installed !== null
 		});
 	}
 	return {
@@ -3317,6 +3381,68 @@ async function readPluginInventory(input = {}) {
 	};
 }
 /**
+* 查 npm registry 上的最新版本（可选功能，默认不开）。
+*
+* 为什么默认关：每个包一次 HTTP 请求，清单会从毫秒级变成好几秒，而用户点进
+* 「插件」页十次里九次只是想看看「装了啥、哪个没启用」。要查更新得显式开。
+*
+* 两个刻意的取舍：
+* - **超时短**（5 秒）：一个包查不动不该拖住整张清单，超时就当「查不到」。
+* - **失败即 null**，不重试：这是锦上添花的信息，为了它排队重试不值当。
+*   界面拿到 null 会说「未检查」，而不是谎称「已是最新」。
+*/
+async function fetchLatestVersion(packageName) {
+	const controller = new AbortController();
+	const timer = setTimeout(() => controller.abort(), 5e3);
+	try {
+		const response = await fetch(`https://registry.npmjs.org/${packageName.replace("/", "%2F")}/latest`, {
+			signal: controller.signal,
+			headers: { accept: "application/json" }
+		});
+		if (!response.ok) return null;
+		const body = await response.json();
+		return typeof body.version === "string" && body.version.trim() ? body.version.trim() : null;
+	} catch {
+		return null;
+	} finally {
+		clearTimeout(timer);
+	}
+}
+/**
+* 给清单里的插件补上「有没有新版本」。
+*
+* 只查**确实装在 profile 里**的第三方包：官方包随运行时发布、用户装不了（查了也没用），
+* 缺失包连本地版本都没有（无从比较）。
+*
+* 并发度限制在 6：十几个包全放出去对 registry 不礼貌，也容易触发限流 ——
+* 而限流之后拿到的 null 会被界面显示成「未检查」，白跑一趟。
+*/
+async function withUpdateCheck(inventory) {
+	const targets = inventory.items.filter((item) => !item.official && item.installed !== null);
+	const latest = /* @__PURE__ */ new Map();
+	const queue = [...targets];
+	const workers = Array.from({ length: Math.min(6, queue.length) }, async () => {
+		for (;;) {
+			const next = queue.shift();
+			if (next === void 0) return;
+			latest.set(next.name, await fetchLatestVersion(next.name));
+		}
+	});
+	await Promise.all(workers);
+	return {
+		...inventory,
+		items: inventory.items.map((item) => {
+			if (!latest.has(item.name)) return item;
+			const newest = latest.get(item.name) ?? null;
+			return {
+				...item,
+				latestVersion: newest,
+				updateAvailable: newest === null || item.installed === null ? null : newest !== item.installed
+			};
+		})
+	};
+}
+/**
 * 判定条目状态。
 *
 * 顺序很重要：**先判「官方包 + 未落盘」**，否则它们会被判成 `declared-missing` ——
@@ -3328,11 +3454,37 @@ function resolveState(input) {
 	if (input.official) return "runtime-provided";
 	return "declared-missing";
 }
-/** 读 `node_modules/<name>/package.json` 的 version；包名含 scope 时要按路径展开。 */
-async function readInstalledVersion(profilePath, packageName) {
+/**
+* 读 `node_modules/<name>/package.json` 的整份内容。
+*
+* 读不到就返回 null（包没装、或装了一半）。刻意不抛：这是展示用的元数据，
+* 某个包读不出来不该让整张清单失败。
+*/
+async function readPackageManifest(profilePath, packageName) {
 	const modulePath = path.join(profilePath, "node_modules", ...packageName.split("/"));
-	const version = (await readJson$1(path.join(modulePath, "package.json")))?.version;
-	return typeof version === "string" && version.trim() ? version : null;
+	return readJson$1(path.join(modulePath, "package.json"));
+}
+/**
+* 从 package.json 里取一个人类可读的主页地址。
+*
+* 三种写法都见过：`homepage` 是字符串、`repository` 是字符串、`repository` 是
+* `{ type, url }` 对象。GitHub 那种 `git+https://…git` 前缀与 `.git` 后缀要剥掉，
+* 否则直接点开是个 git 协议地址，浏览器打不开。
+*/
+function readHomepage(manifest) {
+	if (!manifest) return null;
+	const raw = typeof manifest.homepage === "string" ? manifest.homepage : (() => {
+		const repo = manifest.repository;
+		if (typeof repo === "string") return repo;
+		if (typeof repo === "object" && repo !== null) {
+			const url = repo.url;
+			if (typeof url === "string") return url;
+		}
+		return null;
+	})();
+	if (!raw) return null;
+	const cleaned = raw.trim().replace(/^git\+/, "").replace(/\.git$/, "");
+	return cleaned.startsWith("http") ? cleaned : null;
 }
 function unavailable(profile, profilePath, reason) {
 	return {
@@ -3345,6 +3497,73 @@ function unavailable(profile, profilePath, reason) {
 		items: []
 	};
 }
+var PluginToggleError = class extends Error {
+	code;
+	constructor(code, message) {
+		super(message);
+		this.code = code;
+		this.name = "PluginToggleError";
+	}
+};
+/** 包名合法性白名单：npm 包名允许的字符集，外加 scope 的 `/`。 */
+const PACKAGE_NAME = /^(?:@[a-z0-9][\w.-]*\/)?[a-z0-9][\w.-]*$/i;
+/**
+* 启用（`enable=true`）或停用（`enable=false`）一个插件。
+*
+* @throws PluginToggleError 带着稳定的 `code`，供路由层映射成 HTTP 状态与错误码。
+*/
+async function togglePlugin(name, enable, input = {}) {
+	const trimmed = name.trim();
+	if (!PACKAGE_NAME.test(trimmed)) throw new PluginToggleError("PLUGIN_NAME_INVALID", `Not a valid package name: ${name}`);
+	if (trimmed.startsWith("@deepseek-ai/")) throw new PluginToggleError("PLUGIN_OFFICIAL_IMMUTABLE", "Official DSH packages ship with the runtime and are not managed by the profile.");
+	const profile = resolveProfileName(input);
+	if (!profile) throw new PluginToggleError("PROFILE_UNKNOWN", "Cannot determine the active profile.");
+	const profilePath = path.join(resolveDshHome(input), "profiles", profile);
+	const manifestPath = path.join(profilePath, "package.json");
+	const raw = await readFile(manifestPath, "utf8").catch(() => null);
+	if (raw === null) throw new PluginToggleError("MANIFEST_UNREADABLE", `Cannot read ${manifestPath}`);
+	let manifest;
+	try {
+		manifest = JSON.parse(raw);
+	} catch {
+		throw new PluginToggleError("MANIFEST_UNREADABLE", "The profile manifest is not valid JSON.");
+	}
+	const dependencies = stringRecord(manifest.dependencies);
+	const dshSection = typeof manifest.dsh === "object" && manifest.dsh !== null ? manifest.dsh : {};
+	const profileSection = typeof dshSection.profile === "object" && dshSection.profile !== null ? dshSection.profile : {};
+	const bundles = stringArray(profileSection.bundles);
+	if (enable && dependencies[trimmed] === void 0 && !bundles.includes(trimmed)) throw new PluginToggleError("PLUGIN_NOT_INSTALLED", "This package is not installed in the profile; install it first.");
+	const next = enable ? bundles.includes(trimmed) ? bundles : [...bundles, trimmed] : bundles.filter((item) => item !== trimmed);
+	if (next.length === bundles.length) return {
+		name: trimmed,
+		loaded: enable,
+		backupName: "",
+		bundleCount: bundles.length,
+		restartRequired: true
+	};
+	const backupName = `package.json.bak-${timestamp()}`;
+	await writeFile(path.join(profilePath, backupName), raw, { mode: 384 });
+	profileSection.bundles = next;
+	dshSection.profile = profileSection;
+	manifest.dsh = dshSection;
+	const serialized = `${JSON.stringify(manifest, null, 2)}\n`;
+	const tempPath = path.join(profilePath, `.package.json.tmp-${process.pid}`);
+	await writeFile(tempPath, serialized, { mode: 384 });
+	await rename(tempPath, manifestPath);
+	return {
+		name: trimmed,
+		loaded: enable,
+		backupName,
+		bundleCount: next.length,
+		restartRequired: true
+	};
+}
+/** 备份文件名用的时间戳：`20261013-133045`，本地时区、可直接读。 */
+function timestamp() {
+	const d = /* @__PURE__ */ new Date();
+	const p = (n) => String(n).padStart(2, "0");
+	return `${d.getFullYear()}${p(d.getMonth() + 1)}${p(d.getDate())}-${p(d.getHours())}${p(d.getMinutes())}${p(d.getSeconds())}`;
+}
 //#endregion
 //#region src/host/root-resolver.ts
 /**
@@ -3422,7 +3641,7 @@ async function inspectResolvedPath(root, wirePath) {
 }
 //#endregion
 //#region src/shared/version.ts
-const PLUGIN_VERSION = "2.3.0";
+const PLUGIN_VERSION = "2.3.3";
 //#endregion
 //#region src/host/router.ts
 var ApiRouter = class {
@@ -3621,7 +3840,27 @@ var ApiRouter = class {
 		}
 		if (method === "GET" && pathname === "/api/v1/settings/plugins") {
 			this.options.auth.requireScope(principal, "settings.read");
-			sendJson(res, 200, await readPluginInventory());
+			const inventory = await readPluginInventory();
+			sendJson(res, 200, url.searchParams.get("checkUpdates") === "1" ? await withUpdateCheck(inventory) : inventory);
+			return;
+		}
+		if (method === "PATCH" && pathname === "/api/v1/settings/plugins") {
+			this.options.auth.requireScope(principal, "settings.write");
+			let payload;
+			try {
+				payload = await readJson(req, 8e3);
+			} catch {
+				throw new ApiError(400, "REQUEST_INVALID", "The request body must be valid JSON.");
+			}
+			const name = typeof payload.name === "string" ? payload.name : "";
+			const loaded = payload.loaded;
+			if (name.trim() === "" || typeof loaded !== "boolean") throw new ApiError(400, "REQUEST_INVALID", "Expected { name: string, loaded: boolean }.");
+			try {
+				sendJson(res, 200, await togglePlugin(name, loaded));
+			} catch (error) {
+				if (error instanceof PluginToggleError) throw new ApiError(error.code === "PROFILE_UNKNOWN" || error.code === "MANIFEST_UNREADABLE" ? 503 : 400, error.code, error.message);
+				throw error;
+			}
 			return;
 		}
 		const providerRoute = pathname.match(/^\/api\/v1\/settings\/providers\/([^/]+)$/);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-remote-bridge",
-  "version": "2.3.0",
+  "version": "2.3.3",
   "description": "Versioned REST bridge for DeepSeek Harness: remote access for trusted clients (chat, files, devices) plus a Phone-settings panel inside the DSH WebUI.",
   "type": "module",
   "packageManager": "pnpm@11.19.0",